summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorCatalin Marinas <catalin.marinas@arm.com>2015-06-24 16:58:29 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2015-06-24 17:49:45 -0700
commite781a9ab4847a81224667f5faab0b2bc5f78908f (patch)
tree7a2511fbb4403f68cac254858b2a8275b837a468 /security
parentc5f3b1a51a591c18c8b33983908e7fdda6ae417e (diff)
mm: kmemleak: fix delete_object_*() race when called on the same memory block
Calling delete_object_*() on the same pointer is not a standard use case (unless there is a bug in the code calling kmemleak_free()). However, during kmemleak disabling (error or user triggered via /sys), there is a potential race between kmemleak_free() calls on a CPU and __kmemleak_do_cleanup() on a different CPU. The current delete_object_*() implementation first performs a look-up holding kmemleak_lock, increments the object->use_count and then re-acquires kmemleak_lock to remove the object from object_tree_root and object_list. This patch simplifies the delete_object_*() mechanism to both look up and remove an object from the object_tree_root and object_list atomically (guarded by kmemleak_lock). This allows safe concurrent calls to delete_object_*() on the same pointer without additional locking for synchronising the kmemleak_free_enabled flag. A side effect is a slight improvement in the delete_object_*() performance by avoiding acquiring kmemleak_lock twice and incrementing/decrementing object->use_count. Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions